In a typical computing system or device, one or more application programs, software, or other computer-executable instructions are installed in addition to an operating system to enhance a user's experience with the computing system or device. For example, a user may install a word processing application program to prepare a report and may print the report to a printer connected to the computing system. Another user may install a media processing and managing application software to manage her pictures stored in a digital camera.
The application programs interact with the operating system and/or stored data via a set of routines used by the application program. These routines, also known as an application programming interface (API), direct the performance of some procedures by the operating system. In the word processing application program above, when the user runs the word processing application program, the word processor may initiate a number of API calls to the operating system and its associated components such that the word processor may display a date on the report or may save the location of the report in the computing system in a “Most Used Files” folder/directory. Such API calls may involve reading, writing, creating, or removing one or more files relating to the operating system or in the data store. In addition, some API calls may modify entries in a configuration database associated with the operating system.
While the interactions between application programs and the operating system are designed to enhance the user's experience and perform desired functions, unintended consequences of the interactions may cause application programs or the operating system to operate correctly. For example, a first application program may wish relocate a file from folder B to folder A while a second application program may wish to access the same file in folder B. When the second application program could not find the file in folder B, the second application program may become unstable and hang or cease to continue to operate because the file is missing from folder B. This may further result in failure of the operating system.
Some current systems monitor interactions or memory accesses, such as API calls, between a signal application program and the operating system to prevent crashes or other unexpected consequences. These systems intercept the interactions and identify data relating to the interactions for a particular application program and computing system environment. However, the recorded data from such monitoring systems is limited to the particular application program and computing system environment that is monitored. The data recorded by existing systems is inefficient for making comparison with other systems. For example, suppose interactions between an application A are monitored in a computing system X and the same application A is also monitored in a computing system Y. Both computing systems X and Y execute the same application A, but the computing system X may have a different software and hardware configuration from that of the computing system Y. As such, the locations of the files or data that interact with the application A may be different in the computing system X and the computing system Y. The existing monitoring system would record system specific data (e.g., file path, process ID, or the like) relating to the interactions between the application A and files or data in the computing system X. Such system specific information is not useful when comparing with recorded data from the interaction with the computing system Y because the system specific information of the computing system X differs from the computing system Y.
Accordingly, a system and method for monitoring interactions between a plurality of application programs and stored data and combining the monitored interactions for analysis are desirable to address one or more of these and other disadvantages.